dd-trace 6.14.0 → 6.15.0

package/index.d.ts

@@ -466,6 +466,13 @@ declare namespace tracer {
      * Maximum number of traces matching this rule to sample per second.
      */
     maxPerSecond?: number
+
+    /**
+     * When `true`, a trace chunk rejected by this rule is fully dropped:
+     * it is excluded from client-side stats and never sent to the Agent.
+     * @default false
+     */
+    discard?: boolean
   }
 
   /**
@@ -650,6 +657,7 @@ declare namespace tracer {
      * Sampling rules to apply to priority sampling. Each rule matches against a trace's
      * `service`, `name`, `resource`, and `tags`, and applies the rule's `sampleRate`. Use a
      * `sampleRate` of `0` to drop matching traces (for example to filter out unwanted resources).
+     * Specify `"discard": true` to fully drop it from stats as well.
      * If not specified, will defer to global sampling rate for all spans.
      * @default []
      * @env DD_TRACE_SAMPLING_RULES

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dd-trace",
-  "version": "6.14.0",
+  "version": "6.15.0",
   "description": "Datadog APM tracing client for JavaScript",
   "main": "index.js",
   "typings": "index.d.ts",
@@ -183,8 +183,8 @@
     "opentracing": ">=0.14.7"
   },
   "optionalDependencies": {
-    "@datadog/libdatadog": "^0.20.0",
-    "@datadog/libdatadog-extras": "^0.20.0",
+    "@datadog/libdatadog": "^0.21.0",
+    "@datadog/libdatadog-extras": "^0.21.0",
     "@datadog/native-appsec": "11.0.2",
     "@datadog/native-iast-taint-tracking": "4.2.1",
     "@datadog/native-metrics": "4.0.0",

package/packages/datadog-instrumentations/src/helpers/rewriter/instrumentations/playwright.js

@@ -99,11 +99,7 @@ module.exports = [
       versionRange: '>=1.60.0',
       filePath: 'lib/coreBundle.js',
     },
-    astQuery: 'AssignmentExpression[left.name="Page2"] > ClassExpression > ClassBody > ' +
-      'MethodDefinition[kind="method"][key.name="goto"] > FunctionExpression[async], ' +
-      'VariableDeclarator[id.name="Page2"] > ClassExpression > ClassBody > ' +
-      'MethodDefinition[kind="method"][key.name="goto"] > FunctionExpression[async], ' +
-      'ClassDeclaration[id.name="Page2"] > ClassBody > ' +
+    astQuery: 'ClassExpression[id.name="_Page"] > ClassBody > ' +
       'MethodDefinition[kind="method"][key.name="goto"] > FunctionExpression[async]',
     functionQuery: {
       methodName: 'goto',

package/packages/datadog-instrumentations/src/jest.js

@@ -11,7 +11,7 @@ const path = require('path')
 const satisfies = require('../../../vendor/dist/semifies')
 const { DD_MAJOR } = require('../../../version')
 const shimmer = require('../../datadog-shimmer')
-const { getEnvironmentVariable } = require('../../dd-trace/src/config/helper')
+const { getEnvironmentVariable, getValueFromEnvSources } = require('../../dd-trace/src/config/helper')
 const log = require('../../dd-trace/src/log')
 const {
   EMPTY_EFD_RETRY_POLICY,
@@ -64,6 +64,7 @@ const { addHook, channel } = require('./helpers/instrument')
 const testSessionStartCh = channel('ci:jest:session:start')
 const testSessionFinishCh = channel('ci:jest:session:finish')
 const codeCoverageReportCh = channel('ci:jest:coverage-report')
+const bundlerLoadCh = channel('dd-trace:bundler:load')
 
 const testSessionConfigurationCh = channel('ci:jest:session:configuration')
 
@@ -179,7 +180,9 @@ const wrappedJestEsmLoaders = new WeakSet()
 const wrappedJestObjects = new WeakSet()
 const wrappedWorkerInitializers = new WeakSet()
 const publishedRuntimeReferenceErrors = new WeakMap()
-const jestEsmBypassModulePathsByRuntime = new WeakMap()
+const jestEsmLoggingModulePathsByRuntime = new WeakMap()
+const jestLoggingPackagesByRuntime = new WeakMap()
+const instrumentedJestLoggingModules = new WeakMap()
 const wrappedCoverageReporters = new WeakSet()
 const coverageReporterRequires = new WeakMap()
 const handledJestEvents = new WeakSet()
@@ -3733,13 +3736,15 @@ if (DD_MAJOR < 6) {
   }, jestConfigSyncWrapper)
 }
 
-const LOGGING_LIBRARIES_BYPASSING_JEST_REQUIRE_ENGINE = new Set([
+const JEST_LOGGING_LIBRARIES = new Set([
   'bunyan',
   'pino',
   'winston',
 ])
+const disabledJestInstrumentations = new Set(
+  getValueFromEnvSources('DD_TRACE_DISABLED_INSTRUMENTATIONS')?.split(',')
+)
 const LIBRARIES_BYPASSING_JEST_REQUIRE_ENGINE = new Set([
-  ...LOGGING_LIBRARIES_BYPASSING_JEST_REQUIRE_ENGINE,
   'selenium-webdriver',
   'selenium-webdriver/chrome',
   'selenium-webdriver/edge',
@@ -3884,13 +3889,17 @@ function requireOutsideJestRequireEngine (runtime, moduleName) {
  * @param {string} moduleName
  * @returns {void}
  */
-function recordJestEsmBypassModulePath (runtime, from, moduleName) {
-  if (typeof from !== 'string' || !LOGGING_LIBRARIES_BYPASSING_JEST_REQUIRE_ENGINE.has(moduleName)) return
+function recordJestEsmLoggingModulePath (runtime, from, moduleName) {
+  if (
+    typeof from !== 'string' ||
+    !JEST_LOGGING_LIBRARIES.has(moduleName) ||
+    disabledJestInstrumentations.has(moduleName)
+  ) return
 
-  let pathsByParent = jestEsmBypassModulePathsByRuntime.get(runtime)
+  let pathsByParent = jestEsmLoggingModulePathsByRuntime.get(runtime)
   if (!pathsByParent) {
     pathsByParent = new Map()
-    jestEsmBypassModulePathsByRuntime.set(runtime, pathsByParent)
+    jestEsmLoggingModulePathsByRuntime.set(runtime, pathsByParent)
   }
 
   let modulePaths = pathsByParent.get(from)
@@ -3911,16 +3920,15 @@ function recordJestEsmBypassModulePath (runtime, from, moduleName) {
  * @param {object} runtime
  * @param {string} from
  * @param {string} modulePath
- * @returns {boolean}
+ * @returns {string | undefined}
  */
-function hasJestEsmBypassModulePath (runtime, from, modulePath) {
-  const modulePaths = jestEsmBypassModulePathsByRuntime.get(runtime)?.get(from)
-  if (!modulePaths) return false
+function getJestEsmLoggingModuleName (runtime, from, modulePath) {
+  const modulePaths = jestEsmLoggingModulePathsByRuntime.get(runtime)?.get(from)
+  if (!modulePaths) return
 
-  for (const resolvedPath of modulePaths.values()) {
-    if (resolvedPath === modulePath) return true
+  for (const [moduleName, resolvedPath] of modulePaths) {
+    if (resolvedPath === modulePath) return moduleName
   }
-  return false
 }
 
 /**
@@ -3934,7 +3942,7 @@ function wrapJestEsmLoader (runtime) {
   wrappedJestEsmLoaders.add(esmLoader)
   if (typeof esmLoader.resolveModule === 'function') {
     shimmer.wrap(esmLoader, 'resolveModule', resolveModule => function (moduleName, from) {
-      recordJestEsmBypassModulePath(runtime, from, moduleName)
+      recordJestEsmLoggingModulePath(runtime, from, moduleName)
       return resolveModule.apply(this, arguments)
     })
   }
@@ -3943,7 +3951,7 @@ function wrapJestEsmLoader (runtime) {
       esmLoader,
       'resolveSpecifierForSyncGraph',
       resolveSpecifier => function (from, moduleName) {
-        recordJestEsmBypassModulePath(runtime, from, moduleName)
+        recordJestEsmLoggingModulePath(runtime, from, moduleName)
         return resolveSpecifier.apply(this, arguments)
       }
     )
@@ -3960,11 +3968,10 @@ function getJestBypassModulePath (runtime, from, moduleName) {
   if (typeof from !== 'string' || typeof moduleName !== 'string') return
 
   if (!LIBRARIES_BYPASSING_JEST_REQUIRE_ENGINE.has(moduleName)) {
-    // Jest passes the resolved path when a CommonJS package is imported from an ESM test.
-    if (path.isAbsolute(moduleName) && hasJestEsmBypassModulePath(runtime, from, moduleName)) {
-      return moduleName
-    }
-    return
+    // Keep the native fallback for logging packages that cannot be instrumented in Jest's realm, such as a
+    // package-name-preserving symlink whose target is a user wrapper rather than the package itself.
+    if (path.isAbsolute(moduleName) && getJestEsmLoggingModuleName(runtime, from, moduleName)) return moduleName
+    if (!JEST_LOGGING_LIBRARIES.has(moduleName) || disabledJestInstrumentations.has(moduleName)) return
   }
 
   try {
@@ -3983,6 +3990,113 @@ function getJestBypassModulePath (runtime, from, moduleName) {
   }
 }
 
+/**
+ * @param {object} runtime
+ * @param {string} from
+ * @param {string} moduleName
+ * @returns {string}
+ */
+function resolveJestModulePath (runtime, from, moduleName) {
+  if (path.isAbsolute(moduleName)) return moduleName
+
+  if (typeof runtime._resolveCjsModule === 'function') {
+    return runtime._resolveCjsModule(from, moduleName)
+  } else if (typeof runtime.cjsLoader?.resolution?.resolveCjs === 'function') {
+    return runtime.cjsLoader.resolution.resolveCjs(from, moduleName)
+  }
+  return runtime._resolveModule(from, moduleName)
+}
+
+/**
+ * @param {object} runtime
+ * @param {string} from
+ * @param {string} moduleName
+ * @returns {{ name: string, path: string, version: string } | undefined}
+ */
+function getJestLoggingPackage (runtime, from, moduleName) {
+  if (typeof from !== 'string' || typeof moduleName !== 'string') return
+
+  const directModuleName = JEST_LOGGING_LIBRARIES.has(moduleName) && !disabledJestInstrumentations.has(moduleName)
+    ? moduleName
+    : getJestEsmLoggingModuleName(runtime, from, moduleName)
+  const packages = jestLoggingPackagesByRuntime.get(runtime)
+  let containingPackage
+  if (!directModuleName) {
+    if (!packages) return
+
+    const normalizedFrom = from.replaceAll(path.sep, '/')
+    for (const [packageRoot, loggingPackage] of packages) {
+      if (normalizedFrom.startsWith(`${packageRoot}/`)) {
+        containingPackage = { packageRoot, ...loggingPackage }
+        break
+      }
+    }
+    if (!containingPackage) return
+  }
+
+  try {
+    const modulePath = resolveJestModulePath(runtime, from, moduleName)
+    const normalizedModulePath = modulePath.replaceAll(path.sep, '/')
+
+    if (directModuleName) {
+      if (modulePath !== createRequire(from).resolve(directModuleName)) return
+
+      const nodeModulesPath = `/node_modules/${directModuleName}/`
+      const packagePathIndex = normalizedModulePath.lastIndexOf(nodeModulesPath)
+      if (packagePathIndex === -1) return
+
+      const packageRoot = normalizedModulePath.slice(0, packagePathIndex + nodeModulesPath.length - 1)
+      const { version } = JSON.parse(readFileSync(`${packageRoot}/package.json`, 'utf8'))
+      if (typeof version !== 'string') return
+
+      let runtimePackages = packages
+      if (!runtimePackages) {
+        runtimePackages = new Map()
+        jestLoggingPackagesByRuntime.set(runtime, runtimePackages)
+      }
+      runtimePackages.set(packageRoot, { name: directModuleName, version })
+      return { name: directModuleName, path: directModuleName, version }
+    }
+
+    const { packageRoot, name, version } = containingPackage
+    if (!normalizedModulePath.startsWith(`${packageRoot}/`)) return
+
+    const modulePathWithinPackage = normalizedModulePath.slice(packageRoot.length + 1)
+    return { name, path: `${name}/${modulePathWithinPackage}`, version }
+  } catch {
+    // Let Jest load unresolved, resolver-only, or virtual modules without instrumentation.
+  }
+}
+
+/**
+ * @param {unknown} moduleExports
+ * @param {{ name: string, path: string, version: string } | undefined} loggingPackage
+ * @returns {unknown}
+ */
+function instrumentJestLoggingModule (moduleExports, loggingPackage) {
+  if (!loggingPackage || (typeof moduleExports !== 'object' && typeof moduleExports !== 'function')) {
+    return moduleExports
+  }
+  if (moduleExports === null) return moduleExports
+
+  const instrumentedModule = instrumentedJestLoggingModules.get(moduleExports)
+  if (instrumentedModule) return instrumentedModule
+
+  const payload = {
+    module: moduleExports,
+    package: loggingPackage.name,
+    path: loggingPackage.path,
+    version: loggingPackage.version,
+  }
+  // Apply the regular instrumentation after Jest has evaluated the module so its built-ins stay in Jest's realm.
+  bundlerLoadCh.publish(payload)
+  instrumentedJestLoggingModules.set(moduleExports, payload.module)
+  if (payload.module && (typeof payload.module === 'object' || typeof payload.module === 'function')) {
+    instrumentedJestLoggingModules.set(payload.module, payload.module)
+  }
+  return payload.module
+}
+
 function formatDefaultStackTrace (error, structuredStackTrace) {
   const errorString = Error.prototype.toString.call(error)
   if (structuredStackTrace.length === 0) return errorString
@@ -4009,7 +4123,7 @@ addHook({
   // Jest 28 through 30.3 keeps ESM dependency resolution on Runtime itself.
   if (typeof Runtime.prototype.resolveModule === 'function') {
     shimmer.wrap(Runtime.prototype, 'resolveModule', resolveModule => function (moduleName, from) {
-      recordJestEsmBypassModulePath(this, from, moduleName)
+      recordJestEsmLoggingModulePath(this, from, moduleName)
       return resolveModule.apply(this, arguments)
     })
   }
@@ -4024,11 +4138,13 @@ addHook({
   shimmer.wrap(Runtime.prototype, 'requireModule', requireModule => function (from, moduleName) {
     wrapJestGlobalsForRuntime(this)
     try {
+      const loggingPackage = getJestLoggingPackage(this, from, moduleName)
       // Jest calls requireModule only after deciding that the module should not be mocked.
-      const bypassModulePath = getJestBypassModulePath(this, from, moduleName)
-      const returnedValue = bypassModulePath
+      const bypassModulePath = loggingPackage ? undefined : getJestBypassModulePath(this, from, moduleName)
+      let returnedValue = bypassModulePath
         ? requireOutsideJestRequireEngine(this, bypassModulePath)
         : requireModule.apply(this, arguments)
+      returnedValue = instrumentJestLoggingModule(returnedValue, loggingPackage)
       if (moduleName === '@jest/globals') {
         wrapConcurrentJestGlobalsForRuntime(this, returnedValue)
       }

package/packages/datadog-instrumentations/src/mocha/main.js

@@ -1,5 +1,7 @@
 'use strict'
 
+const { AsyncResource } = require('node:async_hooks')
+
 const { createCoverageMap } = require('../../../../vendor/dist/istanbul-lib-coverage')
 const satisfies = require('../../../../vendor/dist/semifies')
 const { DD_MAJOR } = require('../../../../version')
@@ -80,6 +82,8 @@ const runnerTestEndHandlers = new WeakMap()
 const runnerFailuresAdjusted = new WeakSet()
 const runnerFrameworkErrors = new WeakMap()
 const runnerStarted = new WeakSet()
+const readyRunners = new WeakSet()
+const pendingRunnerStarts = new WeakMap()
 const runnerRecoveryStates = new WeakMap()
 const runnersWithPendingCoverageReset = new WeakSet()
 const parallelRunners = new WeakSet()
@@ -1066,6 +1070,38 @@ function getExecutionConfiguration (runner, isParallel, frameworkVersion, onFini
   runStoresWithCompletion(libraryConfigurationCh, ctx, onReceivedConfiguration)
 }
 
+/**
+ * @param {import('mocha').Runner} runner
+ * @returns {void}
+ */
+function startMochaRunner (runner) {
+  if (readyRunners.has(runner)) {
+    runner.suite.run()
+  } else {
+    // Global setup can finish after configuration. Preserve the configuration
+    // context until Runner#run has installed its delayed-start listener.
+    pendingRunnerStarts.set(runner, AsyncResource.bind(() => runner.suite.run()))
+  }
+}
+
+/**
+ * @param {import('mocha').Runner['run']} run
+ * @param {import('mocha').Runner} runner
+ * @param {Parameters<import('mocha').Runner['run']>} args
+ * @returns {import('mocha').Runner}
+ */
+function runMochaRunner (run, runner, args) {
+  const result = run.apply(runner, args)
+  // Once delay mode is enabled, startup must complete even if the plugin is disabled during global setup.
+  readyRunners.add(runner)
+  const start = pendingRunnerStarts.get(runner)
+  if (start) {
+    pendingRunnerStarts.delete(runner)
+    start()
+  }
+  return result
+}
+
 // In this hook we delay the execution with options.delay to grab library configuration,
 // skippable and known tests.
 // It is called but skipped in parallel mode.
@@ -1118,11 +1154,11 @@ function wrapMochaRun (Mocha, frameworkVersion) {
         getCodeCoverageCh.publish({
           onDone: (receivedCodeCoverage) => {
             untestedCoverage = receivedCodeCoverage
-            global.run()
+            startMochaRunner(runner)
           },
         })
       } else {
-        global.run()
+        startMochaRunner(runner)
       }
     })
 
@@ -1146,7 +1182,7 @@ addHook({
     const mocha = args[0]
 
     /**
-     * This attaches `run` to the global context, which we'll call after
+     * This enables the delayed root suite, which we'll release after
      * our configuration and skippable suites requests.
      * You need this both here and in Mocha#run hook: the programmatic API
      * does not call `runMocha`, so it needs to be in Mocha#run. When using
@@ -1178,7 +1214,7 @@ addHook({
 
   shimmer.wrap(Runner.prototype, 'run', run => function (...args) {
     if (!testFinishCh.hasSubscribers) {
-      return run.apply(this, args)
+      return runMochaRunner(run, this, args)
     }
 
     const { onRunDone, onFlushDone } = getRunCompletionCallbacks(args[0])
@@ -1511,7 +1547,7 @@ addHook({
       }
     })
 
-    return run.apply(this, args)
+    return runMochaRunner(run, this, args)
   })
 
   return Runner

package/packages/datadog-instrumentations/src/playwright.js

@@ -81,6 +81,7 @@ const testsToTestStatuses = new Map()
 const activeRumPages = new Set()
 
 const RUM_FLUSH_WAIT_TIME = getValueFromEnvSources('DD_CIVISIBILITY_RUM_FLUSH_WAIT_MILLIS')
+const isPlaywrightWorker = getValueFromEnvSources('DD_PLAYWRIGHT_WORKER') === '1'
 const DD_PROPERTIES_TIMEOUT = 5000
 const isFailureScreenshotUploadEnabled =
   getValueFromEnvSources('DD_TEST_FAILURE_SCREENSHOTS_ENABLED') === true
@@ -1712,6 +1713,9 @@ createRootSuiteCh.subscribe({
 
 pageGotoCh.subscribe({
   asyncEnd (ctx) {
+    // Playwright library consumers such as Vitest have no Playwright test span and may navigate during page startup.
+    if (!isPlaywrightWorker) return
+
     // The Page.goto rewriter waits for this so tests closing immediately after navigation still get RUM tags.
     const rumDetectionPromise = handlePageGoto(ctx.self)
     ctx.resolveCallback = onDone => rumDetectionPromise.then(onDone, onDone)

package/packages/dd-trace/src/appsec/iast/vulnerabilities-formatter/evidence-redaction/sensitive-analyzers/command-sensitive-analyzer.js

@@ -2,7 +2,9 @@
 
 const log = require('../../../../../log')
 
-const COMMAND_PATTERN = String.raw`^(?:\s*(?:sudo|doas)\s+)?\b\S+\b\s(.*)`
+// `\S+\s` accepts command tokens that end in punctuation. The optional prefix uses horizontal
+// whitespace so multiline matching cannot start inside a line-terminator run.
+const COMMAND_PATTERN = String.raw`^(?:[ \t]*(?:sudo|doas)[ \t]+)?\S+\s([\s\S]*)`
 const pattern = new RegExp(COMMAND_PATTERN, 'gmi')
 
 module.exports = function extractSensitiveRanges (evidence) {